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Dual Rate Control for Security in Cyber-physical Systems 

Mohammad Naghnaeian, Nabil Hirzallah and Petros G. Voulgaris 


Abstract —We consider malicious attacks on actuators and 
sensors of a feedback system which can be modeled as additive, 
possibly unbounded, disturbances at the digital (cyber) part 
of the feedback loop. We precisely characterize the role of 
the unstable poles and zeros of the system in the ability to 
detect stealthy attacks in the context of the sampled data im¬ 
plementation of the controller in feedback with the continuous 
(physical) plant. We show that, if there is a single sensor that 
is guaranteed to be secure and the plant is observable from 
that sensor, then there exist a class of multirate sampled data 
controllers that ensure that all attacks remain detectable. These 
dual rate controllers are sampling the output faster than the 
zero order hold rate that operates on the control input and as 
such, they can even provide better nominal performance than 
single rate, at the price of higher sampling of the continuous 
output. 

I. Introduction 

Security of cyber-physical systems has caught a lot of at¬ 
tention lately. Recent papers along with successful attacks on 
critical infrastructure together revealed many vulnerabilities 
in the practiced methods of control. For instance, [1] showed 
that if a hacker can access the cyber-space of the power grid, 
then it is easy for him to change the power state estimates 
without being detected by the traditional bad data detection 
methods provided that he knows the grid configuration. This 
led to many research papers investigating the security of 
the state estimates and suggesting protective measures in 
addition to investigating attacks on the actuators and/or the 
plant itself. For example, [2], [3] introduce security indices 
which quantify the minimum effort needed to change the 
state estimates without triggering bad-data detectors with 
perfect and imperfect knowledge of the system as constraints. 
In [4] the authors considered attacks on control system 
measurements that are not necessarily bounded or a follow 
a certain distribution and without prior knowledge of the 
system. They show that it is impossible to reconstruct the 
states of the system if more than half of the sensors are 
attacked, generalizing some earlier results in [5]. However, 
an NP-hard problem has to be solved to detect the attacks. In 
[6], [7], the authors inject a signal (unknown to the attacker) 
into the system to detect replay attacks at the expense of 

M. Naghnaeian is a PhD candidate with the Mechanical Science 
and Engineering Department, University of Illinois, Urbana, IL, USA 
naghnae2@Illinois.edu 

N. Hirzallah is a PhD candidate with the Electrical and Com¬ 
puter Engineering Department, University of Illinois, Urbana, IL, USA 
hirzall2@illinois.edu 

P. G. Voulgaris is with the Aerospace Engineering Department and the 
Coordinated Science Laboratory, University of Illinois, Urbana, IL, USA 
voulgari@illinois.edu 

This work was supported in part by the National Science Foundation 
under NSF Award NSF ECCS 10-27437 and AFOSR under award AF FA 
9550-12-1-0193 


increasing the cost of the LQG controller. However, if the 
plant has an unstable zero then it can be shown that an 
undetectable attack can still be designed. In [8], the authors 
suggest the use of dynamic filters that continuously monitor 
the states of the system at every instance of time. However, 
the filters have a serious limitation in that they cannot detect 
zero dynamics attacks. In [9], the authors investigate the class 
of zero dynamics attacks and suggest adding extra sensors 
or even perturbing the plant by adding extra connections to 
remove the unstable zeros. However this may not always be 
feasible in practice. 

In this paper we focus on attacks on actuators and sensors, 
represented as additive and unbounded disturbances on the 
digital (i.e., “cyber”) part of the controlled system. We ex¬ 
amine from an input-output perspective the exact conditions 
under which such attacks can be stealthy, which brings up the 
pivotal role of unstable zeros and poles of the open loop, con¬ 
tinuous time, physical plant. A key point that the paper brings 
is the sampled-data (SD) nature of a controlled cyberphysical 
system which consists of the continuous physical dynamics 
and the digital controller. The importance of the SD nature 
lies in the fact that typically, to ensure good intersample 
behavior, the rate of the sample and hold mechanism has to 
be high enough. It is known however that high sampling rate 
can lead to unstable zeros in the discrete plant dynamics. 
In particular, even if a continuous LTI plant has no 
unstable zeros, its discrete representation Pd obtained by the 
sampled and hold operations will introduce unstable zeros 
if the relative degree of Pc is greater than three (e.g., [10]) 
and the sampling period T ^ 0 (see Figure [T]) Therefore, 
a SD implementation of the controller may create additional 
vulnerability to stealthy attacks and so, it is important to have 
ways that secure the safety of the system while achieving the 
required performance. As one such way, we propose a dual 
rate sampling approach, a special case of multirate sampling 
(MR), whereby the output is sampled at a multiple of the 
hold rate. 

Multirate sampling has been studied extensively in the 
context of sampled-data control in the past and many relevant 
analysis and synthesis results were obtained in the mid 80s 
to mid 90s era (e.g., [11], [12], [13], [14], [15], [16], [17], 
[18] to mention only a few.) An interesting property of multi¬ 
rate sampling is its ability to remove certain unstable zeros 
of the discrete-time system when viewed in the lifted LTI 
domain, which in turn allows for fulfilling certain potential 
design requirements such as gain margin levels, or, strong 
stabilization, that are not possible to satisfy with single rate. 
It is precisely this property that we utilize and study in detail 
in the context of stealthy attack detection. We show that dual 



Fig. 1. The standard SD system 


rate control is sufficient to remove all the vulnerabilities to 
stealthy actuator attacks. Of course, if all sensors are attached 
as well then there is no way to detect attacks. On the other 
hand, we show that if a single measurement output remains 
secure, and if the modes of the system are observable from 
this output, then dual rate systems always provide the ability 
to detect combined sensor-actuator attacks. 

Some standard notation we use is as follows: K", 

C" and denote the sets of non-negative integers, 

n-dimensional real vectors, n-dimensional complex vectors 
and n X m dimensional real matrices, respectively. For any 
M" or C" vector x we denote x' its transpose and \x\ := 
maxii/xf where x' = [xi,X 2 ^ for a sequence of 

real n-dimensional vectors, x = {a;(fc)}fcgz+ we denote 
||a;|| := sup^. |x(fc)|; for a sequence of real nxm dimensional 
real matrices G = {Gk]k£'L+ we denote its A-transform 
■= Sfco For a A-transform a:(A) of a sequence 

x of n-dimensional vectors ||a:(A)|| = ||a:||. 

II. System Model 

We consider the physical, continuous-time, LTI plant Pc = 
[Ac, Bc,Cc, Dc] of Figure that is controlled by a digital 
controller K using the standard zero order hold and sampling 
devices H and S respectively . In particular, in the absence 
of any disturbances da and dg, the digital controller input 
u = {^(fc)} converts to the continuous time input Uc{t) = 
{'Hu){t) = u{k) for kT < t < {k + 1)T where T is the 
hold period, and the digital output y = {y{k)} sequence 
is obtained by sampling the continuous time output j/c with 
the same period T, i.e., y{k) = {Syc){k) = ydkT). The 
corresponding discrete time LTI plant P is defined by the 
relation y = Pu, i.e., P = SPcH, and has a description 
P = [Ad, Bd,Cd, Dd] where the state space matrices are 
obtained from the corresponding continuous time as 

Ad := e Bd:= S 

Jo 

Cd := Cc e Dd :=-Dc G 

( 1 ) 

We assume that the employed realization of the continuous 
plant Pc is minimal, which implies that the same holds 
true for the discrete plant P in the absence of pathological 
sampling (e.g., [10],) i.e., for almost all periods T. 

Also in this figure, we consider the possibility of attacks 
in terms of additive disturbances da and dg respectively at 
the digital input u and at the output y of P. These attacks 
on the digital part of the system can be on actuators only 


> 9 for 


(dg = 0), sensors only (da = 0), or on both, coordinated or 
not. As they act on the cyber part of the system we allow 
them to be unbounded sequences. 

We assume that there is an attack detection mechanism in 
place that monitors u and y and can detect an attack only if 
the effect of da and/or dg on these signals is beyond a given 

noise level threshold 9 > 0, i.e., only if 

some k. Note that we implicitly assume that t 
inputs such as noise, not shown in Fig [T] that have some 
effect on u and y which is what relates to the nonzero noise 
level 9. Accordingly, a stealthy attack will be the case when 
the attack inputs da and/or dg can grow unbounded while 
maintaining their effect on u and y below the detection limit. 
Specifically, if d represents any of da or dg, then the attack is 


(k) 


lere are other 


stealthy if limsupf._^oo \d{k)[ = oo while 


(k) 


< 9 


on the monitoring vector 
be factored as P = M~^ 


Towards this end, let P 


all k = 0,1,2,.... In the sequel we consider various attack 
scenarios and analyze the conditions of their detectability. 

III. Actuator Attacks 

We start with the case when only actuator attacks da are 
present (dg = 0) and proceed in characterizing their effect 

y 

u 

'-N = NM~^ where N, M and 
N, M are left and right coprime respectively, and consider 
the controller K with a similar coprime factorization as K = 
X~^Y = YX~^. The mappings from da to y and u are 
given respectively as (/ — PK)~^P and K{I — PK)~^P. 
Given that K stabilizes P, it holds that MX — NY =: W 
is a stable and stably invertible map (unit). Moreover, it can 
be easily checked that 


y 


■ X ■ 

u 


Y 


WNda 


( 2 ) 


As X and Y are right coprime and kF is a unit, it 
follows that a stealthy attack is possible if and only if 
Nda is bounded for an unbounded da. That is, when 

y 


limsupj._j,oo \daik)[ = oo it holds that 


and only if 


Nda 


< OO if 


< oo. The following proposition is a 
direct consequence of the previous analysis. 

Proposition 1: Let P be a “tall” system, i.e., the number 
of outputs is greater or equal to the number of inputs. Assume 
further that P(A) has no zero on the unit circle |A| = 1. 
Then, an (unbounded) actuator stealthy attack is possible if 
and only if P(A) has a non-minimum phase zero other than 
at A = 0, i.e., a zero for 0 < |A| < 1. 

Proof: Note that the unstable zeros of P are zeros of 
N. Assuming that P is SISO for simplicity with P{zf) = 0 
where 0 < jzol < 1. we have that N{zif) = 0 and 
consequently any input da{k) = will lead via Equation 

y 

^ < eCo where the constant Co > 0 depends 

loop maps. For example, Co could be taken 
(J-P(A)iT(A))-ip(A)^i 


to 


on the closec 
as Co = 


-(-^/zo) 

K(X)iI - P(X)K(X))-^P(X)j^^ 



























































Thus, if e is small enough, e.g., 0 < ^ < cl’ the input 
remains undetected. In the case where P is MIMO, the same 
arguments apply for inputs of the form da{k) = edoZo~’^ 
where do is the zero direction of Zq which can be chosen 
with Idol = 1 . 

To prove the reverse, note that if P has no unstable zeros, 
then the same holds for N and thus Nda < oo implies 
that IIdaII < oOj so no stealth attacks are possible. ■ 

Remark 2: We remark here that if P has zeros on the 
boundary |A| = 1 with no multiplicity but no other unstable 
zeros (other than at A = 0,) then stealth attacks are not 
possible. Indeed, if zo is a simple zero with |zo| = 1, then the 
corresponding input that can be masked (“zeroed out”) is of 
the form da(fc) = edo^o”^ which is bounded with |da(fc)| < 
e, and becomes undetected for small enough e. But this case 
is uninteresting, as the disturbance has a level of noise (which 
can be taken care by any reasonably robust controller.) On 
the other hand, if there are multiplicities, stealthy attacks 
are possible. For example, if P is SISO and zq = 1 is a 
zero with multiplicity 2, then an unbounded input of the 
form da{k) = ek, k = 0,1,... remains undetected for small 
enough e. More generally, in the MIMO case when a zero at 
the boundary has multiplicity, one has to check the Smith- 
McMillan form of P{X) for invariant factors with multiplicity 
corresponding to these zeros: stealthy attacks are possible if 
and only if there are such factors. 

Remark 3: When there is a zero of P at A = 0 there is 
no corresponding (causal) input signal to be “zeroed out.” 

The case when P is “fat”, i.e. when the number of outputs 
y is less than the number of inputs u, is always conducive 
to stealthy attacks as one input can mask the effect of the 
other. Indeed, consider a two input one output P = [Pi P 2 ]; 
the effect of attacks at the individual control channels dai 
and da 2 on the output y is y = Pidai + ^ 2^02 + ^ 2 ]^ 

and thus, picking for example, da 2 = with dai 

arbitrary and unbounded leads to y = [Pi P 2 ]u, i.e. complete 
masking of the attacks. 

IV. Sensor Attacks 

The case of sensor only attack ds ^ 0,da = 0 can 
be viewed in a similar spirit. In particular, by considering 
coprime factorizations for P and K as before, the effect of 
ds on the monitor vector is as 


y 


u 



[I-PK)-^ 
K[I- PK)-^ 


ds — 


X 

Y 


WMds. (3) 


Therefore, using the same rationale as in the previous 
case, we can claim that an attack is detectable if and only 


Md, 


< 00 . This 


if there are no ds with ||(is|| = 00 and 

in turn means that attacks are detectable if and only if M 
has no unstable zeros, which is equivalent that P is a stable 
system. More specifically, we have the following which can 
be proved as in the Proposition [T] 

'strictly speaking, may not exist if P 2 is strictly proper , i.e., P 2 
has a zero at A = 0; but one can always pick dai{X) = Adai(A) with dai 
unbounded and make (P^'Pidai)(A) meaningful. 



Fig. 2. A dual rate SD system 

Proposition 4: Assume that P(A) has no pole on the unit 
circle |A| = 1. Then, a sensor stealthy attack is possible if 
and only if P(A) has a pole with 0 < |A| < 1, i.e., an 
unstable pole other than A = 0. 

Regarding poles of P(A) on the boundary |A| = 1 similar 
remarks hold as in the actuator attack case. Namely, if these 
poles are simple then there is no stealthy attack. If they have 
multiplicities, then their multiplicities in the corresponding 
invariant factors in the Smith-McMillan form determine 
whether stealthy attacks are possible. 

V. Coordinated Actuator Sensor Attacks 

In the case when a coordination of actuator and sensor 
attack is possible, stealthy attacks are always possible even 
in the case where P is stable and minimum phase. Indeed, 
in this case the effect of da can be completely masked by 
canceling its effect at the output via dg'- just pick ds = —Pda 
with da arbitrary and unbounded, then y = Pu. Therefore, 
unless there are outputs that are not attacked, this situation is 
not of interest as there is no hope to detect the attack. If there 
are such attack-free outputs, then the problem reverts to the 
actuator only attack case, with these outputs used for analysis 
and design. As a consequence, in the sequel we consider the 
actuator only attack case where the secure sensor outputs are 
assumed to provide an observable continuous time system 
Pc- 

VI. Dual Rate Control 

In this paper, we focus on a particular MR scheme that 
allows attacks to be detected by ensuring that there are no 
relevant unstable zeros in the lifted system. This scheme 
is simpler to the single rate one with periodic controller 
obtained in the context of gain margin maximization in [19]. 
More specifically, we consider the SD scheme of Figure 
(temporarily without any disturbances) where the output is 
sampled with period T/m where m is a sufficiently large 
integer, i.e., y{k) = {Smyc){t) ■= ydkT/m). A similar 
scheme has been used in [11] in the context of strong 
stabilization. Herein, we provide certain properties of the 
unstable zeros of the lifted system that guarantee detectability 
of actuator attacks. 

To this end, let the corresponding discrete-time system 
mapping m to y be 

G = SmPcH- 

For this MR discrete system we have that 
A™G = GA 

































where A is the 1-step right shift operator on discrete se¬ 
quences {a;(fc)}, i.e., (Aa;)(fc-|-1) = x{k) with (Aa;)(0) = 0. 
Using standard lifting techniques (e.g., [10]) one can obtain a 
shift invariant (LTI) description G of the discrete dynamics 
by grouping the plant input and output signals as u{k) = 
u{k) and y{k) = [y'^{kT/m) y'^{{k+l)T/m)... y'^{{k+m- 
l)T/m)]' (similarly for da and dg.) A state space description 
for G can be obtained as follows: 

Define state space matrices 


A := e M” 

G :=GcG 

Then 


r-Tjm 

B:= , 

Jo 

D := DcGM 


^Badr e 


G = 


A 

B 

G 

D 


(4) 


where 


m— 1 


i = A"* e b=Y^ g 


G = 


G 

CA 


CA^ 


k=0 


rimn^ X n 


D = 


D 

GB + D 


CET=0^'^B 


D 


Also, it becomes useful to define a discrete-time system 
\ A B 1 

Pm '■= - ■ This system corresponds to the single- 


D 

and 


rate sampling and hold scheme of the original plant Pc with 
a period of T/m, i.e., Pm = SmPcHm where Hm is accord¬ 
ingly generating a continuous signal Uc from the discrete u 
as Uc(t) = = u{k) for kT/m <t< {k + l)T/m. 

It is clear that Pm has the same dimension as Pc, i.e. it 
maps Uu inputs to Uy outputs. Moreover, given that Pc holds 
a controllable and observable realization, and the sampling 
is not pathological, it follows that the inherited realization 
of Pm is also controllable and observable. Based on our 
assumptions on the sampling, it is also easily verified that 
the realization of G as above is controllable and observable. 
Let Mq and Nq be the left coprime factors of G. We will 
use the state-space realization of Nq as 


-N, 

G 


( - 

K 


Fig. 3. The lifted system 


is not susceptible either. To this end, the integer m is chosen 
such that the following assumptions are satisfied. 
Assumption 5: The matrix B is full column rank. 

G ' 


Assumption 6: The matrix O : = 


GA 


is full 


column rank. 

The first assumption is standard and holds genetically if 
Be is full column rank in the continuous system. The second 
assumption holds for large enough m, in particular m = 
n -f 1, if the pair (A, G) is observable, which is true as Pm 
is minimal. It can also hold however, even with a small m 
generically. Also, if Assumption]^ holds, G is a tall system. 
Then the following lemma characterizes the zeros of G. 

Lemma 7: Consider the lifted system G as in Q together 
with Assumptions ^ and Then G has at most one non¬ 
minimum zero and is located at A = 1. 

Proof: Since Nq and G have the same non-minimum 
phase zeros, we will prove this lemma for Nq. Notice that 
since Nq is tall, |Ao| < 1 is a zero if and only if there exists 
a vector v G such that 


Ng{Xo)i' = 


AnG 


Notice that 


/ - An A 




B + HD] +D 


u = 0. 


/-A, 


(a + iJG) 


n -1 


is well-defined as all the 


eigenvalues of A + HG are inside the unit circle. Now, 


let ^ = 
multiplying by 
Du = 0, we get 


/-Ao(A + iTG)] (s 

I - Xo(^A + HC 


-HDj u. Then, pre- 
and using AqG^ + 


AqG^ + Du = 0, 
[l - AqA) ^-Bv = 0. 


(6) 

(7) 


A + HG 

B + HD ' 

/c\ l)nyXmny ojygji 


c 

D 

5 

1 

o 

• 0 1 


Na = 


where H is chosen such that A + HC is Schur stable. It is 
easy to show that G and Nq have the same non-minimum 
phase zeros. We consider now the closed loop in the lifted 
domain in Figure where the controller is K and proceed 
to argue that the lifted loop is not susceptible to stealthy 
actuator attacks da, and thus the original MR loop of Figure]^ 


a: = 


0 I -7 


I -I 


we get 


( 8 ) 


XoXC^ + xbv = G [Ao (7 - A) 5 - Bu] = 0. 










































Since O is full column rank by Assumption it holds true 
that 

Ao (A - /) ^ + Bi/ = 0, 
which together with 0 gives 

(^I — AqA^ i? + Aq (A — I) B 
Simplifying further yields 

(1 - Xo)Biy = 0. 

Therefore, if ly is nonzero then Aq = 1 since, by Assumption 
1^ i? is full column rank. ■ 

According to Lemma the lifted system, G, has no zeros 
inside the unit circle. However, it may have a zero at A = 
1. Based on Proposition and Remark an (unbounded) 
actuator stealthy attack will not possible if A = 1 is zero of 
G with multiplicity of at most one. Indeed, this is the case 
as it is proved in the following theorem: 

Theorem 8 : Consider the dual rate SD scheme as in 
Figure]^ Then, there does not exist any (unbounded) actuator 
stealthy attack if Assumptions and are met. 

Proof: As discussed before, we need to show that A = 1 
is a zero of G or equivalently with the multiplicity of at 
most one. It can be argued that ([20]-Section 6.5) A = 1 is 
a zero of algebraic multiplicity greater than one if and only 

Ng (1) 0 

ax^G(A)lA=i 


From (|9|)-([T^, 



C 81 + byi = 

0, 

(13) 


C 82 + by 2 = 

0, 

(14) 


(^I-A^ 8 i-Byi = 

0, 

(15) 

y = 0 . 

-81 + [l - a'^ 82 - By 2 = 

0. 

(16) 


Furthermore, pre-multiplying ([T3]l and ([T4|) 

gives 



XC 8 ,i + xbvi = 0[{I- A) 8,1 - Bvi] = 0, 
XC 82 + Xbv 2 = 0[{I- A) ^2 - Biy^] = 0, 

where X is as in ([^, which in turn imply 

{I-A)8i-Biy^ = 0 , 

(I-A) 82 -Bv 2 = 0 . 

Eliminating ^2 between (fTS]) and (181, we get 


(17) 

(18) 


-{I - A) 8 i-[{I - A)B - (l - A) 


B 


V2 = 0 . 


if the matrix T := 


null chain; that is, there exists a vector y = 


has a right 
with 


Vl 

V 2 


yi A 0, such that = 0. By the way of contradiction, we 
will show that if Tz/ = 0 then vi — 0. Direct calculations 
show that if = 0 then 


G 


C 


/-(i + iJc)] ( 


; B + hd\ + b 


(9) 


I - [A + HC] 


C 


Define, 

Cl = 
6 = 


I-{A + HG 


)] ( 

)r‘( 


B + HD 


Vl 


B + HD] +D 


V2 = 0 . 

( 10 ) 


Notice that {I — A) B — (^I — A^ B — 0 and hence the last 
equation implies 

(I-A)8i = 0 

which in turn, together with implies B^i = 0. By 

Assumption B^i = 0 implies z^i = 0 and this completes 
the proof. ■ 

As a final comment from the previous analysis, we offer 
conditions when G has a zero A = 1. We note that, as proved 
in the previous theorem, these zeros are not a problem since 
they cannot generate stealthy attacks. 

Proposition 9: Let Pc be “tall.” Then G has a zero at 
A = 1 if and only if Pm does. 

Proof: Suppose G has a zero at A = 1. Then, there 
exist vectors 8 v, at least one of them nonzero, such 
that 0 and Q hold for Aq = 1. In particular, from (j^ we 
get 

G8 + Dv = Q. (19) 

Furthermore, pre-multiplying 0 by X results in 
0\{I — A)8 — Bv] = 0 which in turn implies 


[I - A) 8 -Bv = {). 


and ( [20| imply that Pm has a zero at A = 1. 
Conversely, if Pm has a zero at A = 1, 


I - (A + hc) 

' (b + Hb) yi, 

' I -A -B ' 

■ C ■ 

1 V Ji 

V / 

G D 

lb 


I- 


^A + Hc'j + (^B + nb'j 1/2 


= 0 , 


( 20 ) 


( 21 ) 


for some 8 and y. Pre-multiplying it by 


Pre-multiplying and ^2 by 
ing terms we get 


/ - (a -f TJC) 


and group- 


-Cl + (/ - a) ^2 - By 2 


-By, = H 


= H 


+ ,(11) 

(C82 + by2) . ( 12 ) 
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E m—. 
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-G 

-C-GA 
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I 
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( 22 ) 






































= 0. That is, G has a zero at 

A = 1. ■ 

Proposition 10: Let be “fat.” Then G has always a zero 
at A = 1. 

Proof: The proof relies on the fact that since or 
equivalently Pm is fat, there always exist two vectors ^ and 
V with at least one of them nonzero such that holds. 
Then, the rest of the proof follows similarly to that of the 
converse part of Proposition ■ 

Remark 11: We would like to point out that an equivalent 
way of obtaining the same results, i.e., ability to detect 
zero attacks, is to hold the control input longer rather than 
sampling the output faster. That is, if we consider a dual 
rate system where the hold operates with a period of mT 
while the output is sampled with T, then the corresponding 
lifted system will enjoy the same properties as before in 
terms of unstable zeros. Obviously, the (nominal) controller 
performance will be reduced as the control is slower. On 
the other hand, there is a potential benefit of lower cost of 
actuation in this case. 

VII. Conclusion 

We presented a simple dual rate sampled data scheme 
which guarantees detectability of actuator and/or sensor 
attacks, if a secure output that maintains observability of 
the open loop modes is available. The main observation 
is that the sampled data nature in the implementation of 
the cybephysical system cannot be ignored as sampling can 
generate additional vulnerabilities due to the extra unstable 
zeros it may introduce, particularly if high rates are necessary 
to achieve certain performance level. The proposed method 
takes care of this issue by the use of multirate sampling 
that ensures that zeros exist only in harmless locations in 
the lifted domain. We gave certain precise conditions on the 
detectability of stealthy attacks in terms of the open loop 
unstable poles and zeros and showed how the vulnerabilities 
can be eradicated by the use of the dual rate scheme. 

Several other possibilities can be studied in this context. 
The use of asynchronous sampling (e.g., [23], [24]) can 
provide alternative ways to detect stealthy attacks; or even 
the network’s random delays can be helpful in that respect; 
the speed of detecting however needs to be brought into 
consideration, even if the attack is detectable. The methods of 
generalized holds [25] are also relevant as they move zeros, 
and with careful analysis of their robustness properties (e.g., 
[26], [27]) can provide acceptable and simple solutions as 
well. All of these are subjects of current investigations by 
the authors and are documented in forthcoming publications. 
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